GeoServer Unpatched Zero-Day Under Active Internet Probing: Unauthenticated SQL Injection in jsonArrayContains; Government and Utilities Face Largest Exposure
On 12 August 2026, researcher q1uf3ng disclosed an unauthenticated SQL injection zero-day in GeoServer jsonArrayContains. No CVE, no CVSS, no official patch. watchTowr observed mass internet probing. Independent sources cross-confirmed arbitrary SQL execution against H2 and SQL Server backends; admin-level DB accounts escalate to RCE.
Incident Overview
On 12 August 2026 at 10:46 UTC, researcher q1uf3ng disclosed on X an unauthenticated SQL injection in GeoServer's jsonArrayContains OGC filter function. GeoServer is widely deployed by government GIS offices, defense mapping agencies, and utilities. Prior GeoServer CVEs have repeatedly entered the CISA KEV catalog. From disclosure, watchTowr observed hundreds of probe requests across the global internet. Multiple threat-intel vendors published on 13–15 August. Field Effect assessed this as the zero-day most warranted for BOD 22-01 / CERT-In / SEBI CSCRF / NIS2 emergency vulnerability lists to date.
Technical Details
jsonArrayContains is a built-in GeoTools OGC Filter/CQL function that tests whether a JSON array field contains a given value. When the backend datastore uses PostGIS, Oracle JDBC, or SQL Server JDBC, GeoServer does not adequately sanitize function arguments when generating backend SQL. An attacker who controls portions of the filter expression can inject arbitrary SQL fragments.
SecurityWeek, citing the researcher: deployments connecting to SQL Server as sa (sysadmin) can chain SQL Server execution primitives (xp_cmdshell and similar) into RCE. Field Effect further flags H2 + admin-account deployments as a high-risk RCE path.
CVE-2023-25157/25158 previously patched SQLi in the same filter for PostGIS/Oracle paths. The 2026 disclosure targets the still-unpatched SQL Server backend path. OSGeo has not published an official advisory or affected-version list. Version numbers alone cannot determine immunity.
Impact Assessment
The vulnerability is in a zero-CVE, zero-patch state. CVE-driven vulnerability-management workflows do not apply. Field Effect, BlackTree, Cybersrcc, CSO Online, and The Hacker News tracked the story in lockstep on 13–14 August. watchTowr confirmed hundreds of probes that trigger HTTP 500, concentrated on a small set of source IPs. Attackers remain in target identification. No ransomware, webshell, or persistence observed yet. GeoServer CVE-2024-36401 previously compromised U.S. federal agencies with three weeks of retained access. A similar secondary-exploitation window is highly likely.
Remediation
- Asset inventory: enumerate all internet-exposed GeoServer instances. Record GeoServer version, backend database (PostGIS/Oracle/H2/SQL Server), and DB connection-account privilege level.
- Temporary mitigation: pull GeoServer off direct internet exposure; restrict to trusted networks, VPN, or reverse proxy. WAF: whitelist or syntax-validate jsonArrayContains calls. Alert on unauthenticated requests that return HTTP 500 with SQL exception stacks.
- Defense in depth: drop GeoServer DB accounts to non-admin. Disable xp_cmdshell and equivalent high-risk primitives. Separate database and OS privilege surfaces. Enable WFS/WMS/WCS logging; monitor anomalous CQL filter parameters.
- Incident response: track watchTowr and OSGeo follow-on advisories. Patch immediately once a CVE and official fix ship. On suspected compromise, review all access logs from the prior 3–6 months and purge possible webshells and persistence accounts.
Note for Operators in China
Natural resources, surveying/mapping, and environmental agencies, plus municipal territorial spatial information platforms, widely run GeoServer for WMS/WFS. Some municipal systems sit directly on government extranets. This zero-day has no authentication prerequisite; any attacker who can reach an OGC endpoint can probe. Many domestic government deployments leave the H2 sample database enabled for demos. Once an attacker finds an H2 + admin configuration, the SQLi-to-xp_cmdshell RCE chain matches the overseas disclosure. Until an OSGeo official patch ships: pull every GeoServer instance facing the government extranet or the internet behind intranet or reverse proxy. WAF: block all jsonArrayContains calls and flag them in audit logs; bulk-allow only after the patch is live.
Historical Comparison and Watch Items
GeoServer CVE-2024-36401 (CVSS 9.8) in 2024 compromised U.S. federal agencies with three weeks of retained access, concurrent with cryptomining, botnets, and China-nexus APT lateral movement. This jsonArrayContains zero-day has a narrower attack surface than 2024 (depends on specific backend config) but a longer patch-wait window (OSGeo community disclosure typically 5–15 business days). Field Effect, BlackTree, Cybersrcc and others assess high probability that at least one ransomware crew will fold this into an initial-access kit before a patch ships. Watch: OSGeo GitHub commits, watchTowr daily internet-probe intensity, follow-on disclosure from q1uf3ng on Twitter/X.
Sources
- Field Effect: Early exploitation attempts observed of GeoServer zero day
- BlackTree: GeoServer Zero-Day — No Patch as Attackers Probe Servers
- Cybersrcc: GeoServer Zero-Day Enables Potential RCE
- C-Suite Exchange: Active Exploitation Attempts Detected
- GeoServer OSGeo project homepage (patch-wait tracking)